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Abstract 

We consider quantum cryptographic schemes where the carriers of informa- 
tion are 3-state particles. One protocol uses four mutually unbiased bases 
and appears to provide better security than obtainable with 2-state carriers. 
Another possible method allows quantum states to belong to more than one 
basis. The security is not better, but many curious features arise. 

PACS numbers: 03.67.-a, 03.67.Dd, 03.65. Bz 



1 



Typeset using REVT^ 



When Samuel Morse invented the telegraph, he devised for it an alphabet consisting 
of three symbols: dash, dot, and space. More modern communication methods use binary 
signals, conventionally called and 1. Information theory, whose initial goal was to improve 
communication efficiency, naturally introduced binary digits (bits) as its accounting units. 
However, the theory can easily be reformulated in terms of ternary digits (trits) 0, 1, 2, or 
larger sets of symbols For example, instead of bytes (sets of 8 bits) representing 256 
ordinary characters, we would have "trytes" (5 trits) for 243 characters. An ordinary text 
would thus be encoded into a string of trits. If we wish to encrypt the latter, this can be 
done by adding to it (modulo 3) a random string, called key, known only to legitimate users. 
Decrypting is then performed by subtracting that key (modulo 3). 

The aim of quantum cryptography p[ is to generate a secret key by using quantum 
carriers for the initial communication between distant parties (conventionally called Alice 
and Bob). The simplest methods use 2-state systems, such as polarized photons. Orthogonal 
states represent bit values and 1. One may use either two or three orthogonal 
bases, chosen in such a way that any basis vectors \ej) and |e^) belonging to different bases 
satisfy |(ej,e^)p = 1/2. Such bases are called mutually unbiased As a consequence, 

if an eavesdropper (Eve) uses the wrong basis, she gets no information at all and causes 
maximal disturbance (error rate 1/2) to the transmission, thereby revealing her presence. 

In this Letter, we consider 3-state systems as the quantum carriers for cryptographic 
key distribution. For example, one may use "biphotons" 0, namely photon pairs in sym- 
metric Fock states |0,2), |2,0), and |1, 1). Biphotons can easily be produced with present 
technology, and detecting arbitrary linear combinations of them will probably be possible 
soon. (Another possibility would be to use four states of a pair of photons [§], but here we 
consider only 3-state systems.) 

Following the method of refs. we introduce four mutually unbiased bases. Let \a), 
1/3), and I7) be the unit vectors of one of the bases. Another basis is obtained by a discrete 
Fourier transform. 
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\a') = (!«) + 1/5) + |7))/v^, 

1/3') = (|a) + e2-/3|/5) + e-2-/3|^))/y3^ 

lY) = (|«) + e-2-/3|/?) + e2-/3|^))/v^. 



(1) 



The two other bases can be taken as 



(e^^^/^la) + \(3) + |7))/V3 and cydic perm., 



(2) 



and 



(e-2^^/^|a) + \(3) + |7))/V3 and cydic perm.. 



(3) 



Any basis vectors |ej) and |e^) belonging to different bases now satisfy |(ej,e^)p = 1/3. 

The protocol for establishing a secret key is the usual one. Alice randomly chooses one 
of the 12 vectors and sends to Bob a signal whose quantum state is represented by that 
vector. Bob randomly chooses one of the four bases and "measures" the signal (that is, 
Bob tests whether the signal is one of the basis vectors). Having done that, Bob publicly 
reveals which basis he chose, but not the result he obtained. Alice then reveals whether her 
vector belongs to that basis. If it does, Alice and Bob share the knowledge of one trit. If 
it does not, that transmission was useless. This procedure is repeated until Alice and Bob 
have obtained a long enough key. They will then have to sacrifice some of the trits for error 
correction and privacy amplification (we shall not discuss these points, which are the 
same as in all cryptographic protocols, except that we have to use trits instead of bits, and 
therefore parity checks become triality checks, that is, sums modulo 3). 

Consider the simplest eavesdropping strategy: Eve intercepts a particle, measures it, 
and resends to Bob the state that she found. In 3/4 of the cases, she uses a wrong basis, 
gets no information, and causes maximal disturbance to the transmission: Bob's error rate 
(that is, the probability of a wrong identification of the trit value) is 2/3. On the average, 
over all transmissions. Eve gets J^; = 1/4 of a trit and Bob's error rate is Eb = 1/2. (It 
is natural to measure Eve's information in trits, since Bob gets one trit for each successful 
transmission.) These results may be compared to those obtained by using 2-state systems. 
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With only two bases as in ref. and with the same simple eavesdropping strategy, Eve 
learns on the average 1/2 of a bit for each transmitted bit, and Bob's error rate is 1/4. If we 
use three bases as in these numbers become 1/3. Thus, with the present method. Eve 
learns a smaller fraction of the information and causes a larger disturbance. It is likely that 
this is also true in presence of more sophisticated eavesdropping strategies, such as using an 
ancilla to gently probe the transmission without completely disrupting it. When people seek 
Eve's "optimal" eavesdropping strategy [|lOl, their criterion usually is the maximal value of 
Ie/Eb- 

Do the above results mean that using 3-state systems improves the cryptographic secu- 
rity? The answer depends on which aim we seek to achieve. If Alice and Bob simply wish 
to be warned that an eavesdropper is active, and in that case they will use another commu- 
nication channel, then obviously the highest possible ratio Eb/Ie is desirable. Eve can at 
most conceal her presence by intercepting only a small fraction x of the transmissions, such 
that xEb is less than the natural error rate, but then Ie is reduced by the same factor, and 
Eve's illicit information can be eliminated by classical privacy amplification 

However it may be that Alice and Bob have no alternative channel to use and privacy 
amplification is their only possibility of fighting the eavesdropper. In that case, it is known 
||TT| , p!2|| that secure communication can in principle be achieved if Bob's mutual information 
with Alice, J^, is larger than Eve's Ie- Note that even if Bob and Eve have the same error 
rate, as in one of the above examples, Ie > Ib- The reason is that Eve knows whether Alice 
and Bob used the same basis, and therefore which ones of her data are correct and which 
ones are worthless. On the other hand. Bob can only compare with Alice a subset of data, 
so as to measure his mean error rate Eb-, and from the latter deduce the Shannon entropy 
of his string. For 2-state systems, assuming all bit values equally probable, he obtains 

= 1 + (1 - Eb) log2(l - Eb) + Eb \og^ Eb, (4) 

and likewise for 3-state systems, 

= 1 + (1 - Eb) log3(l - Eb) + Eb \og^{EB/2). (5) 

4 



Numerical results, in bits and trits respectively, will be given in Table II at the end of this 
Letter, together with those for two other cryptographic protocols, discussed below. 

New types of cryptographic protocols may indeed be devised if the Hilbert space has 
more than two dimensions. The reason is that a basis vector may now belong to several 
bases. In that case, it is natural to assume that each vector represents a definite trit (0, 1, or 
2), which is the same in all the bases to which that vector belongs [|l3l. An example is given 



in the table below, where vectors are labelled green, red, and blue, for later convenience. 

TABLE I. Components of 21 unnormalized vectors. The symbols 1 and 2 
stand for —1 and —2, respectively. Orthogonal vectors have different colors. 



green 001 101 Oil 111 112 112 211 
red 100 110 101 111 211 211 121 
blue 010 Oil 110 ill 121 121 112 



Although this new algorithm does not improve transmission security (as shown below), 
it has many fascinating aspects and leads to new insights into quantum information theory. 
The 12 vectors in the first four columns of Table I are shown in Fig. 1, as dots on the faces 
of a cube, in a way similar to the graphical representation of a Kochen-Specker uncolorable 
set [Q. In the present case, the tricolor analogue of the Kochen-Specker theorem requires 
only 13 rays for its proof, because ray (111) is orthogonal to all the rays in the third column, 
which have three different colors. These 12 vectors form 13 bases, but only four bases are 
complete. The nine others bases have only two vectors each and have to be completed by 
nine new vectors, listed in the last three columns of the table. To display these nine vectors 
on Fig. 1, their integer components should be divided by 2. The corresponding dots are then 
located at the centers of various squares on the faces of the cube. 

The cryptographic protocol is the same as before, but now Alice has 21 vectors to choose 
from, and Bob has a choice of 13 bases. The essential difference is that these bases are 
not mutually unbiased, so that if Eve chooses a different basis (which happens 12/13 of the 
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time), she still gets at least probabilistic information on Alice's vector. It may also happen 
that Eve's basis is different from Bob's, but both bases contain the vector found by Eve. In 
that case, when Bob announces his basis and Alice confirms it. Eve can infer that she got 
the correct state and caused no error. 

Let us analyze what happens for each successful transmission, that is, when Alice's vector 
\ej) is one of those in the basis announced by Bob. Suppose that in her eavesdropping 
attempt. Eve obtains a state |e^). This happens with probability P^j = |(ej,e^)p. This is 
also the probability that Bob gets the correct \ej) when Eve resends to him |e^). On the 
average over all Alice's \ej) and all Eve's choices of a basis, the probability that Bob gets a 
correct result is 

C^ = EE^.(^M.)V(21xl3), (6) 

j = l tM=l 

where is the number of bases to which |e^) belongs (namely = 2 for the vectors in 
the first and third columns of Table I, = 3 for those of the second and fourth columns, 
and = 1 for the rest). Bob's mean error probability is Eb = 1 — C = 0.385022. 

To evaluate Eve's gain of information Ie, we note that when Alice confirms the basis 
chosen by Bob, Eve is left with a choice of three vectors having equal prior probabilities, 
Pj = 1/3. The initial Shannon entropy is Hi = 1 trit, and the prior probability for Eve's 
result /i is 

9/. = E^«P. = 1/3. (7) 

j=0 

It then follows from Bayes's theorem that the likelihood (posterior probability) of signal j 



is (see ref. page 282) 

Qj^, = P^,jPj/qf, = Pf,j. (8) 
The new Shannon entropy, following result n, is 

Hf = -j2Q,,log,Q,,. (9) 

j=0 



Eve's information gain is obtained by averaging Hf over all results all Eve's bases, and 
all Bob's bases. The final result is 

lE^Hi-{Hf), (10) 

^l + J2Y.MjM, P,^ log3 P,j /(3 X 13^). (11) 

j=i M=i 

Table II lists the relevant data for intercept-and-resend eavesdropping (IRE) on all the above 
cryptographic protocols. 

TABLE II. Result of IRE on various cryptographic protocols: Eve's information; 

Bob's information and error rate for a single IRE event; and fraction of eaves- 
dropped transmissions needed to make both informations equal to each other. 



units 


bases 


vectors 


Ie 


Ib 


Eb 


X 


bits 


2 


4 


0.500000 


0.188722 


0.250000 


0.68214 


bits 


3 


6 


0.333333 


0.081710 


0.333333 


0.68128 


trits 


4 


12 


0.250000 


0.053605 


0.500000 


0.71770 


trits 


13 


12 


0.575142 


0.143418 


0.391738 


0.51007 


trits 


13 


21 


0.442765 


0.150431 


0.385022 


0.68994 



We also investigated the possibility that Alice uses only the 12 vectors in the first four 
columns of Table I (those represented by the dots in Fig. 1). The IRE results are also listed 
in Table II. However, it is interesting that in this case. Eve can get some information with- 
out performing any active eavesdropping and without causing any error, just by passively 
listening and waiting for Alice to confirm Bob's choice of an incomplete basis. Eve then 
learns that one of the three trit values is eliminated. On the average, she gets information 

Ie = (9/13) (1 + log3 2) = 0.255510 trit. (12) 

Finally, let us investigate what happens if Eve eavesdrops only on a fraction x of the 
particles sent by Alice. In that case, both Ie and Eb are multiplied by x, and Ib is still 
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given by Eqs. (|) and (^), with Eb replaced by xEb on the right hand side. The results are 
displayed in Fig. 2, which also shows the security domain Ib > Ie, assuming standard error 
correction and privacy amplification The values of x for which Ib = Ie are listed in 
the last column of Table II. We see that the use of four mutually unbiased bases for 3-state 
particles requires the highest value of x to breach the security. Moreover, for any given value 
of Ibi this protocol is the one that gives the lowest value of Ie- It thus appears that this 
method is the one giving the best results against IRE attacks. It is likely to also be the best 
for more sophisticated eavesdropping strategies, but this problem lies beyond the scope of 
the present Letter. 
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FIG. 1. Twelve vectors are obtained by connecting the center of the cube to the various 
dots on its faces (diametrically opposite dots represent the same vector). The four dots at 
the vertices of the squares labelled G, R, and B, are green, red and blue, respectively. The 
truncated vertex corresponds to the uncolorable ray (111). 
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Alice-Eve mutual information 

2-dim., 2 bases [2] 

2-dim., 3 bases [3,4] 

3-dim., 13 bases, 12 vectors 



3-dim., 13 bases, 21 vectors 

3-dim., 4 mutually unbiased bases 

FIG. 2. Mutual informations for the various protocols listed in Table II, when the fraction 
of intercepted particles is < x < 1. For the case of 13 bases and 12 vectors, it is assumed 
that in the remaining fraction (1 — x), Eve performs passive eavesdropping on incomplete 
bases. The data are given in bits for 2-dimensional systems, and trits for 3-dimensional ones. 
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